Legal

Privacy Policy

Last updated: October 31, 2026

This policy explains how LayeredTrust.ai, Inc. ("LayeredTrust", "we", "us") handles personal information. It covers two things: this website (layeredtrust.ai), and the LayeredTrust service that our customers use to govern the actions of AI agents (the "Service"). They are treated differently, so the sections below keep them apart.

1. Who is responsible

For the personal information described in sections 2 to 7 (website visitors, people who contact us, and people who subscribe to our articles), LayeredTrust.ai, Inc. is the controller. You can reach us by email at info@layeredtrust.ai or through the contact form on this website.

For personal information that customers place in the Service, the customer is the controller and we act as a processor on the customer's instructions. See section 9.

2. What we collect through this website

Information you give us

  • Contact form: your name, work email address, company name, and the message you write.
  • Article subscription: your name and email address.
  • Registration: if you register for an account, or otherwise choose to give us information about yourself, such as profile or company details, we process what you provide.
  • Email: anything you send to us directly, including your address and the content of your messages.

Information collected automatically

  • Server logs: like most web servers, ours records the IP address, date and time, pages requested, browser type and referring page for each request. We use this to keep the site running and to detect abuse.

Cookies

We may set cookies and similar technologies, for example to keep you signed in if you register, to remember your preferences and to help keep the site secure. Where the law requires your consent for a cookie, we will ask for it first. You can block or delete cookies in your browser settings, although parts of the site may then not work as intended.

When you register to view the product demos, or submit the Contact or Stay Connected form, we set one first-party cookie, lt_demo_reg, so we do not ask again on that browser for 90 days. It contains no personal information. On pages opened without a web server, the same 90-day mark is kept in browser storage instead. To have your contact information removed from our database, use the Opt out link in the footer of any page.

We do not knowingly collect special categories of personal data through the site, and ask that you do not send any.

3. Why we use it, and our legal bases

  • To provide an account you register for, and to respond to enquiries and arrange a walkthrough. Legal basis: our legitimate interest in running our business and replying to people who contact us, and steps taken at your request before entering into a contract.
  • To send you articles you asked for. Legal basis: your consent, which you can withdraw at any time using the contact details above.
  • To keep the site secure and working. Legal basis: our legitimate interest in the security and reliability of our systems.
  • To meet legal obligations and handle legal claims. Legal basis: compliance with law, or our legitimate interest in establishing or defending legal claims.

We do not use your information for automated decision-making that has legal or similarly significant effects on you.

4. Who we share it with

We share personal information only as needed to run the site and our business:

  • Formspree (formspree.io) receives what you submit in our contact and subscription forms and delivers it to us by email. It acts as our service provider.
  • Google provides the email service we use to receive, read and answer your messages and to manage our email.
  • Hosting and infrastructure providers, currently Amazon Web Services and/or Google Cloud, host the site and its logs.
  • Professional advisers, and authorities where we are required to by law or need to protect our rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. International transfers

We are based in the United States, and our providers, including Formspree and Google, may process information in the United States and other countries. Where personal information from the European Economic Area, the United Kingdom or Switzerland is transferred to a country that does not have an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or a provider's certification under the EU-U.S. Data Privacy Framework. For the data region used for the Service, see section 9.

6. How long we keep it

  • Contact form and email enquiries: 24 months after our last contact with you, unless we enter into a business relationship, in which case the relevant records are kept for as long as that relationship and our legal obligations require.
  • Article subscription and demo registration: until you opt out (using the Opt out link in the footer) or ask us to delete it.
  • Server logs: 24 months.

We may keep information longer where the law requires it or where it is needed for a legal claim.

7. Your rights

Depending on where you live, you may have the right to ask us to give you access to your personal information, correct it, delete it, restrict or object to how we use it, give it to you in a portable format, and withdraw consent you gave us. You also have the right to lodge a complaint with your local data protection authority. If you are in California, you have similar rights to know, delete and correct, and you will not be treated differently for using them.

To use any of these rights, email info@layeredtrust.ai. We may need to confirm who you are first. We aim to reply within one month. If the information you ask about is held in the Service on a customer's behalf, we will direct you to that customer.

8. Security

We use technical and organisational measures that we consider appropriate to the risk to protect personal information, such as access controls and encryption in transit. No system is completely secure, so we cannot guarantee absolute security. Where the law requires us to tell you or a regulator about a breach, we will.

9. The LayeredTrust Service

The Service lets a customer set rules for what its AI agents may do, require a named person to approve actions beyond those rules, and keep a signed record of what happened. This section applies to information a customer processes in the Service.

Our role

The customer decides what goes into the Service and why. We process that information on the customer's behalf and on its documented instructions, under our agreement with the customer, which includes data processing terms where the law requires them. If you are an individual whose information is in a customer's Service account, for example an approver, please contact that customer first.

What the Service may hold

  • Account details for the customer's personnel who use the Service, such as name, work email, role and sign-in records. Sign-in is provided through WorkOS.
  • Agent and credential records: identifiers for agents, the credentials issued to them, and the limits and policies the customer defines.
  • Request and decision records: the action an agent asked to take, details the customer's configuration includes in the request (which may include amounts, counterparties or other business data), the decision, and who approved or denied it and when.
  • Connection details the customer provides so that approved actions can reach its business systems, Secrets and tokens are stored encrypted at rest.

How we use it

We use customer information to provide, secure, support and improve the Service, and as the customer instructs. We do not currently use customer content to train AI models. That may change in the future, and if it does we will update this policy and act as our customer agreements and applicable law require. We do not sell customer information.

Sub-processors, location and retention

We use sub-processors, such as infrastructure providers, to run the Service, and will make the current list available to customers on request. Customer information for customers in the United States and Canada is stored in the United States, and for customers in the European Union it is stored in the European Union. Retention periods are set in the customer agreement, and we delete or return customer information at the end of the agreement as that agreement describes.

10. Children

Our website and Service are intended for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, tell us and we will delete it.

11. Links to other sites

Our site may link to other websites. We are not responsible for their content or privacy practices.

12. Changes to this policy

We may update this policy as our practices or the law change. The date at the top shows when it last changed. If a change is significant, we will take reasonable steps to let you know.

13. Contact

Questions or requests about this policy: info@layeredtrust.ai.